Ion Auth - Lightweight Auth System based on Redux Auth 2

[eluser]maltzurra[/eluser]
These days modern browsers remember passwords for you, so I don't think it's a bad idea to rely on them, specially if your app contains _VERY_ sensitive data. Anyway, Drupal's persistent login aproach does minimise impact a lot. It works this way:

- When the user successfully logs in with Remember Me checked, a login cookie is issued in addition to the standard session management cookie.[2]

- The login cookie contains the user's username, a series identifier, and a token. The series and token are unguessable random numbers from a suitably large space. All three are stored together in a database table.

- When a non-logged-in user visits the site and presents a login cookie, the username, series, and token are looked up in the database.

- If the triplet is present, the user is considered authenticated. The used token is removed from the database. A new token is generated, stored in database with the username and the same series identifier, and a new login cookie containing all three is issued to the user.

- If the username and series are present but the token does not match, a theft is assumed. The user receives a strongly worded warning and all of the user's remembered sessions are deleted.

- If the username and series are not present, the login cookie is ignored.

http://jaspan.com/improved_persistent_lo...t_practice